Isaca Updated CRISC Exam Questions and Answers by eira

When assessing the likelihood that a recently discovered software vulnerability will be exploited, the most important consideration is the skill level required of a threat actor. Here's an explanation:

Skill Level of Threat Actors:

The skill level required to exploit a vulnerability determines how accessible the exploit is to potential attackers.

If a vulnerability requires advanced technical skills to exploit, it is less likely to be targeted by less sophisticated attackers.

Conversely, if the exploit can be easily executed with minimal skills, it increases the likelihood of widespread exploitation.

Factors Influencing Likelihood of Exploitation:

Availability of Exploit Tools: If automated tools or scripts are available to exploit the vulnerability, even less skilled attackers can take advantage of it.

Publication of Exploit Details: If the vulnerability and its exploitation method are widely published, it becomes more accessible to a broader range of attackers.

Assessment of Likelihood:

Security teams assess the skill level required by analyzing whether the exploit is straightforward or complex.

They also consider the presence of exploit kits in the wild that could lower the barrier to entry for potential attackers.

Comparison with Other Factors:

Amount of PII Disclosed: While important, it relates more to the impact rather than the likelihood of exploitation.

Ability to Detect and Trace: This is crucial for response but does not directly influence the likelihood of exploitation.

Amount of Data Exposed: Similar to PII, this factor pertains to the impact rather than the likelihood of exploitation.

References:

The CRISC Review Manual discusses the importance of understanding the threat landscape, including the skill level of potential attackers (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.2.1 Internal Threats).

The greatest benefit of using IT risk scenarios is that they facilitate communication of risk, as they provide a clear and realistic description of the risk sources, events, impacts, and responses, and enable the stakeholders to understand and appreciate the risk exposure and appetite of the organization. Supporting compliance with regulations, providing evidence of risk assessment, and enabling the use of key risk indicators (KRIs) are also benefits of using IT risk scenarios, but they are not the greatest benefit, as they are more related to the outcomes or consequences of risk communication, rather than the process or value of risk communication. References = CRISC Review Manual, 7th Edition, page 100.

When an organization has a policy prohibiting ransom payments in the event of a ransomware attack, the most effective control to support this policy is creating immutable backups. Here’s why:

Immutable Backups:

Definition: Immutable backups are backups that cannot be altered, deleted, or modified in any way once they are created. This ensures that a clean, untampered copy of data is always available.

Protection Against Ransomware: Ransomware attacks typically encrypt data and demand a ransom to decrypt it. With immutable backups, the organization can restore the affected systems using the backup without paying the ransom, thereby adhering to their policy.

Effectiveness:

Restoration Capability: Immutable backups provide a reliable means to restore data to its state before the ransomware attack. This restoration capability negates the need to consider paying the ransom to regain access to encrypted data.

Compliance with Policy: By having a secure and untouchable backup, the organization ensures compliance with its no-ransom policy as it can recover operations without engaging with the attackers.

Comparison with Other Options:

Vulnerability Scanning: While important, this primarily helps in identifying vulnerabilities and does not directly help in data recovery post-ransomware attack.

Patching: Regular patching reduces the risk of ransomware infection but does not aid in recovery if an attack occurs.

Intrusion Detection: Continuous monitoring can detect ransomware activities but does not provide a solution for restoring data after an attack.

References:

The CRISC Review Manual emphasizes the importance of data backups and specifically highlights the advantages of immutable backups in maintaining data integrity and availability in the face of attacks .

The data owner should be accountable for ensuring that media containing financial information are adequately destroyed per an organization’s data disposal policy, as they have the authority and responsibility to define the classification, retention, and disposal requirements for the data they own. The compliance manager, the data architect, and the chief information officer (CIO) are not the best choices, as they have different roles and responsibilities related to data governance, design, and strategy, respectively, but they do not own the data. References = CRISC Review Manual, 7th Edition, page 154.